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Taking GDPR enforcement really seriously: What to expect 
from the GDPR Procedural Regulation? (12 December 2023) 


By Michaél Van den Poel: 


On 12 December 2023, the Brussels Privacy Hub hosted a webinar covering the proposed GDPR Procedural 
Regulation.2 The event was moderated by prof. Sophie Stalla-Bourdillon, co-director of the Brussels 
Privacy Hub, and featured several experienced speakers. MEP Sergey Lagodinsky, rapporteur for the LIBE 
committee spoke on the Draft Report he authored for the European Parliament. The event also featured 
Max Schrems from noyb, Alberto Di Felice from DigitalEurope and prof. Gloria Gonzalez Fuster, co- 
director of the Law, Science, Technology and Society (LSTS) Research Group at the Vrije Universiteit Brussel 
(VUB). 


MEP Sergey Lagodinsky started by contextualizing the Proposal in an environment of increasing criticism 
of GDPR enforcement, noting that lengthy and complex cross-border procedures could ‘produce an 
adverse effect on citizens trust’. He repeated the Parliaments call for a common administrative procedure 
for cross-border cases in the GDPR to improve enforcement. The Proposal faces two main challenges and 
challengers according to him. First, the industry has challenged the Proposal due to it not amending the 
content of the GDPR, which it sees as cumbersome to comply with. Second, from the point of view of 
individuals, the Proposal would harm the rights of complainants, as it creates an asymmetry of arms 
benefitting controllers and processors at the detriment of complaints’ procedural rights. This approach 
mirrors criminal law procedures, with a focus on the rights of defendants, whereas he believes that a civil 
law approach with equality of arms between parties would be more suitable. Whilst retaining national 
procedural standards, the Proposal should be amended to include procedural safeguards such as the right 
to be heard and the right to translation for all parties. The Draft Report also includes a joint case file, which 


1 Executive Team member at the Brussels Privacy Hub, PhD researcher at LSTS/VUB. 
2 Commission, ‘Proposal for a Regulation of the European Parliament and of the Council Laying down Additional Procedural 
Rules Relating to the Enforcement of Regulation (EU) 2016/679 (General Data Protection Regulation) COM(2023) 348 Final’ 
(‘Proposal’). 
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differs from the administrative file in article 19-21 of the Proposal in that it would be accessible for all 
parties, including the complainant. 


Max Schrems criticized the ‘ivory tower’ approach taken by the European Commission. Practitioners from 
noyb have to face widely diverging procedures throughout, for example having to take pictures of a 
physical file in Poland in order to get access to access. These differences also impact the dispute resolution 
mechanism in the EDPB, with the Irish Data Protection Commissioner (‘DPC’) withholding certain 
information from its peers, breaching the principle of procedural fairness. 

Commenting on the Proposal, Max Schrems pointed to four significant flaws. First, the Proposal does not 
adequately address the differences between complain-based and ex officio cases, and between 
procedures resulting in potential penalties and those that do not. Second, the Proposal changes the 
institutional balance in the GDPR from co-decision making between supervisory authorities to more power 
granted to the lead supervisory authority. Third, the Proposal has not fulfilled its promises, as it was 
originally intended to harmonize most procedural aspects, but has since seen reduced ambitions. This 
raises quality issues, as national law would still apply, but the Proposal does not include a conflict of laws 
approach to settle disputes between different Member States laws. Fourth, the approach to confidentiality 
is overly restrictive. According to Max Schrems, public criticism is the only remaining source of public 
accountability for supervisory authorities, in the absence of effective accountability to the three classical 
branches of government. 

The Draft Report would improve on many of these issues, by bringing the Proposal more in line with 
existing procedural standards and introducing conflict of laws procedures. Specifically on article 18 of the 
Proposal which would remove the possibility to issue relevant and reasoned objections on the scope, he 
did not raise any concern with the approach adopted in the Draft Report, which contrary to the opinion of 
the EDPB and EDPS does not just delete Article 18 of the Proposal. The Draft Report instead aims to 
address the concerns by the EDPB and EDPS by widening the scope of relevant and reasoned objections to 
factual elements in the draft decision and the joint case file, instead of just the draft decision, whilst also 
deleting the limitation to three pages contained in article 18(2)(a) Proposal. 

Max Schrems agrees with the European Commission’s introduction of a summary of key issues, which 
should enable supervisory authorities to comment on the scope of the case at an earlier stage. Supervisory 
authorities should however retain the possibility to shape the different aspects of the scope later on, in 
order to avoid manipulation of the case by the lead supervisory authority. 


Alberto Di Felice states that the Proposal is modest, expanding on the GDPR without reopening it. He 
disagrees with Max Schrems and the Draft Report on institutional aspects. As administrative procedures, 
similar to competition law, procedures before a supervisory authority should not be based on civil or penal 
law. The implementation of an adversarial process would thus not be desirable. He also disagrees on the 
perceived ineffectiveness of GDPR enforcement, as supervisory authorities today have many powers and 
are using these to enforce the GDPR. Whilst some high-profile cases are taking a long time and are 
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currently being scrutinized before the courts, many cases are handled in a smooth fashion. On 
confidentiality, he disagrees with the position of Max Schrems, noting that access to case information is 
solely meant to be able to argue before the supervisory authority, and not to leak documents to the press. 


Responding to Alberto Di Felice, Max Schrems noted that most Member States already have a right to be 
heard before the supervisory authority for complainants. In addition, he references the two SCHUFA cases? 
where the Court of Justice noted that a complaint is not merely a petition. He also disagrees with the 
success of GDPR enforcement, pointing at many noyb cases which are taking years to be resolved by 
supervisory authorities. 


The final speaker, prof. Gloria Gonzalez Fuster started by placing the Proposal in the broader context of 
GDPR enforcement. The GDPR itself was a response to a lack of enforcement of earlier legislation. After 
the adoption of the GDPR, discussions shifted to insufficient funding of national supervisory authorities. 
After this was addressed by Member States, supervisory authorities identified yet another obstacle to 
effective enforcement in the form of divergent national laws inhibiting cooperation. The EDPB ‘Wish List’ 
was a response to the call for help by national supervisory authorities, which has then been followed by 
the European Commission’s Proposal. Prof. Gonzalez Fuster highlighted that from a political view, it should 
be ensured that this finally gets enforcement on the rails, and that no further issues pop up. 

On amicable settlements, she noted that this phenomenon is relatively new in data protection. It is only 
referenced in a limited way in the recitals of the GDPR, but has since expanded to now being included in 
the Proposal. The most notable user has been the DPC, which has made extensive use of amicable 
settlements within the One-Stop-Shop in a manner that was not envisioned in the GDPR. Whilst the EDPB 
has been slowly normalising these settlements, many supervisory authorities do not use them, as they are 
not regulated in many Member States. It is thus surprising that neither the Draft Report, nor the Joint 
Opinion by the EDPB and EDPS challenge the premise of amicable settlements. 

Reacting to a Dutch government submission to the European Commission, prof. Gonzalez Fuster believes 
that the reasons for generally promoting amicable settlements are severely flawed. First, time constraints 
do not make a convincing argument. As following up from Article 77 GDPR and more recently the SCHUFA 
judgements, complaints have to be handled by supervisory authorities, and cannot be simply dismissed or 
settled. Second, she challenges the argument that amicable settlements provide for an expedited way to 
solve problems. On the basis of public information in the EDPB One-Stop-Shop transparency register, she 
noted that supervisory authorities (i.c. the DPC) have taken up to two years to reach amicable settlements. 
Whilst this argument would hold if a deadline of e.g. a month would be instituted, this is currently not the 
case. Third, amicable settlements are often presented as effectuating the will of the concerned individual. 
This is equally false in practice, as the DPC merely informs individuals of amicable settlements. Whilst 
individuals can in principle challenge these announced settlements, there are cases where the DPC has 


3 Cases C-634/21 and C-26/22 SCHUFA Holding [2023]. 
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dismissed a reaction after refusing an amicable settlement (see for example Case 2022/473 of the DPC, 
referenced footnote 9 of this contribution by prof. Gloria Gonzalez Fuster). 

The EDPB/EDPS Joint Opinion notes correctly that an amicable settlement is not the same thing as the 
withdrawal of a complaint, and is in itself a decision. The Draft Report is problematic in considering 
amicable settlements acceptable as mere agreements between complainants and controllers. This runs 
counter to the text of the GDPR, which contains procedures on cases before supervisory authorities (article 
77 GDPR) and a right to an effective remedy before the courts (article 79 GDPR), but no provision on 
alternative dispute resolution between controllers and complainants. 


Max Schrems offered a complementary perspective on amicable settlements. The definitions of amicable 
settlements vary between countries. He argued that individual rights are subjective rights, and can be 
waived in certain legal systems and under certain conditions. However, breaches of the GDPR may and 
should still be sanctioned by supervisory authorities. On the funding of supervisory authorities, he noted 
the importance of efficiency, with the DPC having the same budget as the Spanish AEPD, but outputting 
significantly less decisions. A comparison can be drawn with asylum applications, where thousands of cases 
are handled. 


Prof. Gloria Gonzalez Fuster saluted creative approaches such as those used by the Belgian supervisory 
authority, which can help data subjects with the exercise of data subject rights through mediation, which 
if successful removes the need for them to launch a complaint. Reacting to Schrems’ comments, she noted 
that all important procedural aspects should be harmonized, in order not to create a Russian doll made of 
many layers, i.e., the GDPR, the Proposal and national laws. Finally, she stressed that the EDPB’s register 
of One-Stop-Shop decisions deserves more attention. The register is functioning, serving as a database 
with many publicly available cross-border decisions, but currently not all supervisory authorities publish 
their decisions there. A potential obligation to use the register could be beneficial, but neither the Proposal 
nor the Draft Report include a provision on it. 


Max Schrems agreed with Prof. Gloria Gonzalez Fuster on the transparency register. He further believes 
that we should be careful not to overwhelm judges, as they are already having difficulties with applying 
the GDPR. The Proposal will create new procedural rules they are not accustomed to. Finally, he explains 
how the system envisioned by noyb would function. The Proposal should only apply directly upon the 
relationship between supervisory authorities. The relation between individuals, controllers/processors 
and their respective supervisory authorities would continue to be governed solely by member state law, 
which the proposal could strengthen through the obligation for Member States to implement minimum 
procedural standards. 


